A method and system for performing incremental backup of a network attached storage (NAS) device are described. A storage capture instance associated with a first time instance is received from a network attached storage device. At least a portion of metadata of tracked network packets associated with the network attached storage device is also received. At least one changed content item of the network attached storage device that has changed since the first time instance is identified by analyzing the at least the portion of the metadata of the tracked network packets received. An incremental backup of the network attached storage device is performed at a second time instance based at least in part on the at least one changed content item identified.